Executive brief
Google MCP Toolbox for Databases, a tool used to manage database interactions, contains a security flaw that allows users with limited access to perform unauthorized administrative actions. By manipulating the protocol version used in their requests, an authenticated user can bypass security checks that were only implemented in newer versions of the software. This could lead to unauthorized data access or the execution of high-privilege administrative commands.
Technical details
An authenticated authorization bypass exists in MCP Toolbox for Databases due to inconsistent scope enforcement across Model Context Protocol (MCP) handlers. While the 2025-11-25 protocol version correctly validates 'scopesRequired' for tool execution, older supported versions (2025-06-18, 2025-03-26, and 2024-11-05) omit these checks. A remote attacker with a valid low-privilege token (e.g., read-only) can bypass intended restrictions by setting the 'MCP-Protocol-Version' header to a vulnerable version or omitting it to trigger the default 2024-11-05 handler. This allows the execution of administrative tools. The issue was addressed by centralizing scope validation logic across all protocol versions.
Affected products
- Google MCP Toolbox for Databases (googleapis/mcp-toolbox) 1.3.0
Timeline
- 2026-05-13: other: Initial tool-level scope validation implemented in version 2025-11-25
- 2026-06-03: patched: Fix merged to centralize validation across all protocol versions
- 2026-06-18: disclosed
- 2026-06-18: advisory